topic Re: Security implementation on /etc/fstab in Operating System - HP-UX

Security implementation on /etc/fstab

Spark_2 — Tue, 29 Sep 2009 10:22:54 GMT

In course of hardening my hp-ux box, what all can be done in /etc/fstab. Like modifying permissions etc

What all filesystems may need it

Re: Security implementation on /etc/fstab

Duncan Edmonstone — Tue, 29 Sep 2009 10:38:28 GMT

again a completely pointless exercise as even if I set permissions on /etc/fstab to 600, a non priviliged user can still exceute bdf, df and "/sbin/mount -p" to see what filesystems are mounted.

Your client is wasting his time with these sort of unconsidered security measures...

HTH

Duncan

Re: Security implementation on /etc/fstab

James R. Ferguson — Tue, 29 Sep 2009 10:40:25 GMT

Hi:

Yes, I wonder...is this security by obscurity?

The standard permission are -rw-r--r-- with root ownership. What's the problem with being able to see what's mounted? If that's an issue, you have far deeper problems in my opinion.

Regards!

...JRF...

Re: Security implementation on /etc/fstab

Spark_2 — Tue, 29 Sep 2009 10:41:01 GMT

:-)...well is client is God

its like he wants to control the permissions of mounted fs like:

/dev/hda5 /tmp ext2 rw,nosuid,nodev,noexec, 1 2
/dev/hda9 /home ext2 rw,nosuid,nodev 1 2

My question is what all fs should be controlled and what should be the permissions

Re: Security implementation on /etc/fstab

TTr — Tue, 29 Sep 2009 10:45:55 GMT

Any user can type "mount" or "bdf" or "df" and get the mounted filesystems.

There is nothing special in /etc/fstab. It is volumes and filesystems and everybody knows and expects that. What kind of server is this, how many end users are on and what are you protecting yourself from?

Re: Security implementation on /etc/fstab

Spark_2 — Tue, 29 Sep 2009 10:49:20 GMT

I want to set the best security on the filesystem permissions. Like

/dev/hda5 /tmp ext2 rw,nosuid,nodev,noexec, 1 2
/dev/hda9 /home ext2 rw,nosuid,nodev 1 2

What all filesystems should be controlled and with what permissions please

Re: Security implementation on /etc/fstab

James R. Ferguson — Tue, 29 Sep 2009 10:58:47 GMT

Hi (again):

> /dev/hda5 /tmp ext2 rw,nosuid,nodev,noexec, 1 2

This looks like a snippet from an AIX box, not HP-UX.

That said, I would mark non-OS filesystems as 'nosuid' if you want to increase your security. If I am correct, and this is AIX, I suggest you read those manpages and decide what additional protection those options might offer.

Regards!

...JRF...

Re: Security implementation on /etc/fstab

Spark_2 — Tue, 29 Sep 2009 11:15:12 GMT

ok...for an HPUX box...what all filesystems should be controlled and how

Re: Security implementation on /etc/fstab

James R. Ferguson — Tue, 29 Sep 2009 11:18:40 GMT

Hi (again):

> ok...for an HPUX box...what all filesystems should be controlled and how

I answered that in my response above when I pointed out the some of your mount options were appropriate to AIX servers. Read my response again.

...JRF...